https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-21T05:38:13.930338+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-29354 EUVD-2026-29354 2026-10-21T05:38:13.984980+00:00 EUVD-2026-29354 https://cve.radiocsirt.org/vuln/fkie_cve-2021-36383 fkie_cve-2021-36383 2026-10-21T05:38:13.985038+00:00

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

 https://cve.radiocsirt.org/vuln/ghsa-grvm-gcqf-gh8q GHSA-grvm-gcqf-gh8q — Xen Orchestra Mishandles Authorization 2026-10-21T05:38:13.985089+00:00

Affected: npm: xo-web, npm: xo-server

Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket `resourceSet.getAll` data is which the attacker changes the permission field from none to admin. The attacker gains access to data sets such as VMs, Backups, Audit, Users, and Groups.

 https://cve.radiocsirt.org/vuln/gsd-2021-36383 gsd-2021-36383 2026-10-21T05:38:13.985130+00:00 gsd-2021-36383